[GIT PULL] vfs: file

[GIT PULL] vfs: file

[Christian Brauner]

Hey Linus,

/* Summary */
This contains Amir's work to fix a long-standing problem where an
unprivileged overlayfs mount can be used to avoid fanotify permission
events that were requested for an inode or superblock on the underlying
filesystem.

Some background about files opened in overlayfs. If a file is opened in
overlayfs @file->f_path will refer to a "fake" path. What this means is
that while @file->f_inode will refer to inode of the underlying layer,
@file->f_path refers to an overlayfs {dentry,vfsmount} pair. The reasons
for doing this are out of scope here but it is the reason why the vfs
has been providing the open_with_fake_path() helper for overlayfs for
very long time now. So nothing new here.

This is for sure not very elegant and everyone including the overlayfs
maintainers agree. Improving this significantly would involve more
fragile and potentially rather invasive changes.

In various codepaths access to the path of the underlying
filesystem is needed for such hybrid file. The best example is fsnotify
where this becomes security relevant. Passing the overlayfs
@file->f_path->dentry will cause fsnotify to skip generating fsnotify
events registered on the underlying inode or superblock.

To fix this we extend the vfs provided open_with_fake_path() concept for
overlayfs to create a backing file container that holds the real path
and to expose a helper that can be used by relevant callers to get
access to the path of the underlying filesystem through the new
file_real_path() helper. This pattern is similar to what we do in
d_real() and d_real_inode().

The first beneficiary is fsnotify and fixes the security sensitive
problem mentioned above.

There's a couple of nice cleanups included as well.

Over time, the old open_with_fake_path() helper added specifically for
overlayfs a long time ago started to get used in other places such as
cachefiles. Even though cachefiles have nothing to do with hybrid files.

The only reason cachefiles used that concept was that files opened with
open_with_fake_path() aren't charged against the caller's open file
limit by raising FMODE_NOACCOUNT. It's just mere coincidence that both
overlayfs and cachefiles need to ensure to not overcharge the caller for
their internal open calls.

So this work disentangles FMODE_NOACCOUNT use cases and backing file
use-cases by adding the FMODE_BACKING flag which indicates that the file
can be used to retrieve the backing file of another filesystem. (Fyi,
Jens will be sending you a really nice cleanup from Christoph that gets
rid of 3 FMODE_* flags otherwise this would be the last fmode_t bit we'd
be using.)

So now overlayfs becomes the sole user of the renamed
open_with_fake_path() helper which is now named backing_file_open(). For
internal kernel users such as cachefiles that are only interested in
FMODE_NOACCOUNT but not in FMODE_BACKING we add a new kernel_file_open()
helper which opens a file without being charged against the caller's
open file limit. All new helpers are properly documented and clearly
annotated to mention their special uses.

We also rename vfs_tmpfile_open() to kernel_tmpfile_open() to clearly
distinguish it from vfs_tmpfile() and align it the other kernel_*()
internal helpers.

/* Testing */
clang: Ubuntu clang version 15.0.7
gcc: (Ubuntu 12.2.0-3ubuntu1) 12.2.0

All patches are based on v6.4-rc2 and have been sitting in linux-next.
No build failures or warnings were observed. All old and new tests in
fstests, selftests, and LTP pass without regressions.

/* Conflicts */
There has one merge conflict:

(1) This will cause a minor merge conflict with my v6.5/vfs.misc pull
    request as we rename an internal helper that's used in cachefiles.
    I would suggest to merge v6.5/vfs.misc first.

The following changes since commit f1fcbaa18b28dec10281551dfe6ed3a3ed80e3d6:

  Linux 6.4-rc2 (2023-05-14 12:51:40 -0700)

are available in the Git repository at:

  git@gitolite.kernel.org:pub/scm/linux/kernel/git/vfs/vfs tags/v6.5/vfs.file

for you to fetch changes up to bc2473c90fca55bf95b2ab6af1dacee26a4f92f6:

  ovl: enable fsnotify events on underlying real files (2023-06-19 18:18:04 +0200)

Please consider pulling these changes from the signed v6.5/vfs.file tag.

Thanks!
Christian

----------------------------------------------------------------
v6.5/vfs.file

----------------------------------------------------------------
Amir Goldstein (5):
      fs: rename {vfs,kernel}_tmpfile_open()
      fs: use a helper for opening kernel internal files
      fs: move kmem_cache_zalloc() into alloc_empty_file*() helpers
      fs: use backing_file container for internal files with "fake" f_path
      ovl: enable fsnotify events on underlying real files

 fs/cachefiles/namei.c    | 10 +++---
 fs/file_table.c          | 91 +++++++++++++++++++++++++++++++++++++++---------
 fs/internal.h            |  5 +--
 fs/namei.c               | 24 +++++++------
 fs/open.c                | 76 ++++++++++++++++++++++++++++++++++------
 fs/overlayfs/file.c      |  8 ++---
 fs/overlayfs/overlayfs.h |  5 +--
 include/linux/fs.h       | 42 +++++++++++++++++-----
 include/linux/fsnotify.h |  4 ++-
 9 files changed, 204 insertions(+), 61 deletions(-)

Re: [GIT PULL] vfs: file

[pr-tracker-bot]

The pull request you sent on Fri, 23 Jun 2023 13:03:18 +0200:

> git@gitolite.kernel.org:pub/scm/linux/kernel/git/vfs/vfs tags/v6.5/vfs.file

has been merged into torvalds/linux.git:
https://git.kernel.org/torvalds/c/1f2300a7382119a857cc09e95db6e5d6fd813163

Thank you!

-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/prtracker.html

[GIT PULL] vfs file

[Christian Brauner]

Hey Linus,

/* Summary */

This is the work to cleanup and shrink struct file significantly. You
should've already seen most of the work in here.

Right now, (focussing on x86) struct file is 232 bytes. After this
series struct file will be 184 bytes aka 3 cacheline and a spare 8 bytes
for future extensions at the end of the struct.

With struct file being as ubiquitous as it is this should make a
difference for file heavy workloads and allow further optimizations in
the future.

* struct fown_struct was embeeded into struct file letting it take up 32
  bytes in total when really it shouldn't even be embedded in struct
  file in the first place. Instead, actual users of struct fown_struct
  now allocate the struct on demand. This frees up 24 bytes.

* Move struct file_ra_state into the union containg the cleanup hooks
  and move f_iocb_flags out of the union. This closes a 4 byte hole we
  created earlier and brings struct file to 192 bytes. Which means
  struct file is 3 cachelines and we managed to shrink it by 40 bytes.

* Reorder struct file so that nothing crosses a cacheline. I suspect
  that in the future we will end up reordering some members to mitigate
  false sharing issues or just because someone does actually provide
  really good perf data.

* Shrinking struct file to 192 bytes is only part of the work. Files use
  a slab that is SLAB_TYPESAFE_BY_RCU and when a kmem cache is created
  with SLAB_TYPESAFE_BY_RCU the free pointer must be located outside of
  the object because the cache doesn't know what part of the memory can
  safely be overwritten as it may be needed to prevent object recycling.

  That has the consequence that SLAB_TYPESAFE_BY_RCU may end up adding a
  new cacheline.

  So this also contains work to add a new kmem_cache_create_rcu()
  function that allows the caller to specify an offset where the
  freelist pointer is supposed to be placed. Thus avoiding the implicit
  addition of a fourth cacheline.

* And finally this removes the f_version member in struct file. The
  f_version member isn't particularly well-defined. It is mainly used as
  a cookie to detect concurrent seeks when iterating directories. But it
  is also abused by some subsystems for completely unrelated things.

  It is mostly a directory and filesystem specific thing that doesn't
  really need to live in struct file and with its wonky semantics it
  really lacks a specific function.

  For pipes, f_version is (ab)used to defer poll notifications until a
  write has happened. And struct pipe_inode_info is used by multiple
  struct files in their ->private_data so there's no chance of pushing
  that down into file->private_data without introducing another pointer
  indirection.

  But pipes don't rely on f_pos_lock so this adds a union into struct
  file encompassing f_pos_lock and a pipe specific f_pipe member that
  pipes can use. This union of course can be extended to other file
  types and is similar to what we do in struct inode already.

/* Testing */

gcc version 14.2.0 (Debian 14.2.0-3)
Debian clang version 16.0.6 (27+b1)

All patches are based on v6.11-rc4 and have been sitting in linux-next.
No build failures or warnings were observed.

/* Conflicts */

Merge conflicts with mainline
=============================

No known conflicts.

Merge conflicts with other trees
================================

(1) This will have merge conflict with the vfs.misc pull request sent as:
    https://lore.kernel.org/r/20240913-vfs-misc-348ac639e66e@brauner

    Assuming you merge vfs.misc first the conflict resolution looks like this:

diff --cc fs/fcntl.c
index 22ec683ad8f8,0587a0e221a6..f6fde75a3bd5
--- a/fs/fcntl.c
+++ b/fs/fcntl.c
@@@ -343,12 -414,30 +414,36 @@@ static long f_dupfd_query(int fd, struc
        return f.file == filp;
  }

 +/* Let the caller figure out whether a given file was just created. */
 +static long f_created_query(const struct file *filp)
 +{
 +      return !!(filp->f_mode & FMODE_CREATED);
 +}
 +
+ static int f_owner_sig(struct file *filp, int signum, bool setsig)
+ {
+       int ret = 0;
+       struct fown_struct *f_owner;
+
+       might_sleep();
+
+       if (setsig) {
+               if (!valid_signal(signum))
+                       return -EINVAL;
+
+               ret = file_f_owner_allocate(filp);
+               if (ret)
+                       return ret;
+       }
+
+       f_owner = file_f_owner(filp);
+       if (setsig)
+               f_owner->signum = signum;
+       else if (f_owner)
+               ret = f_owner->signum;
+       return ret;
+ }
+
  static long do_fcntl(int fd, unsigned int cmd, unsigned long arg,
                struct file *filp)
  {

(2) linux-next: manual merge of the security tree with the vfs-brauner tree
    https://lore.kernel.org/r/20240910132740.775b92e1@canb.auug.org.au

The following changes since commit 47ac09b91befbb6a235ab620c32af719f8208399:

  Linux 6.11-rc4 (2024-08-18 13:17:27 -0700)

are available in the Git repository at:

  git@gitolite.kernel.org:pub/scm/linux/kernel/git/vfs/vfs tags/vfs-6.12.file

for you to fetch changes up to 24a988f75c8a5f16ef935c51039700e985767eb9:

  Merge patch series "file: remove f_version" (2024-09-12 11:58:46 +0200)

Please consider pulling these changes from the signed vfs-6.12.file tag.

Note that this work provides the base for the slab pull request this
cycle. So just to not mess with Vlastimil's pr I pushed two tags:

(1) vfs-6.12.file
(2) vfs-6.12.file.kmem

The second tag only contains what slab relies on and (1) contains
everything for this cycle. If you disagree with additional stuff in (1)
you may still consider pulling (2).

Thanks!
Christian

----------------------------------------------------------------
vfs-6.12.file

----------------------------------------------------------------
Christian Brauner (27):
      file: reclaim 24 bytes from f_owner
      fs: switch f_iocb_flags and f_ra
      fs: pack struct file
      mm: remove unused argument from create_cache()
      mm: add kmem_cache_create_rcu()
      fs: use kmem_cache_create_rcu()
      Merge patch series "fs,mm: add kmem_cache_create_rcu()"
      adi: remove unused f_version
      ceph: remove unused f_version
      s390: remove unused f_version
      fs: add vfs_setpos_cookie()
      fs: add must_set_pos()
      fs: use must_set_pos()
      fs: add generic_llseek_cookie()
      affs: store cookie in private data
      ext2: store cookie in private data
      ext4: store cookie in private data
      input: remove f_version abuse
      ocfs2: store cookie in private data
      proc: store cookie in private data
      udf: store cookie in private data
      ufs: store cookie in private data
      ubifs: store cookie in private data
      fs: add f_pipe
      pipe: use f_pipe
      fs: remove f_version
      Merge patch series "file: remove f_version"

R Sundar (1):
      mm: Removed @freeptr_offset to prevent doc warning

 drivers/char/adi.c             |   1 -
 drivers/input/input.c          |  47 ++++++-----
 drivers/net/tun.c              |   6 ++
 drivers/s390/char/hmcdrv_dev.c |   3 -
 drivers/tty/tty_io.c           |   6 ++
 fs/affs/dir.c                  |  44 +++++++++--
 fs/ceph/dir.c                  |   1 -
 fs/ext2/dir.c                  |  28 ++++++-
 fs/ext4/dir.c                  |  50 ++++++------
 fs/ext4/ext4.h                 |   2 +
 fs/ext4/inline.c               |   7 +-
 fs/fcntl.c                     | 166 +++++++++++++++++++++++++++++++--------
 fs/file_table.c                |  16 ++--
 fs/internal.h                  |   1 +
 fs/locks.c                     |   6 +-
 fs/notify/dnotify/dnotify.c    |   6 +-
 fs/ocfs2/dir.c                 |   3 +-
 fs/ocfs2/file.c                |  11 ++-
 fs/ocfs2/file.h                |   1 +
 fs/pipe.c                      |   8 +-
 fs/proc/base.c                 |  30 ++++++--
 fs/read_write.c                | 171 +++++++++++++++++++++++++++++++----------
 fs/ubifs/dir.c                 |  64 ++++++++++-----
 fs/udf/dir.c                   |  28 ++++++-
 fs/ufs/dir.c                   |  28 ++++++-
 include/linux/fs.h             | 106 +++++++++++++++----------
 include/linux/slab.h           |   9 +++
 mm/slab.h                      |   2 +
 mm/slab_common.c               | 138 +++++++++++++++++++++++----------
 mm/slub.c                      |  20 +++--
 net/core/sock.c                |   2 +-
 security/selinux/hooks.c       |   2 +-
 security/smack/smack_lsm.c     |   2 +-
 33 files changed, 744 insertions(+), 271 deletions(-)

Re: [GIT PULL] vfs file

[pr-tracker-bot]

The pull request you sent on Fri, 13 Sep 2024 16:43:10 +0200:

> git@gitolite.kernel.org:pub/scm/linux/kernel/git/vfs/vfs tags/vfs-6.12.file

has been merged into torvalds/linux.git:
https://git.kernel.org/torvalds/c/3352633ce6b221d64bf40644d412d9670e7d56e3

Thank you!

-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/prtracker.html

[GIT PULL] vfs file

[Christian Brauner]

Hey Linus,

/* Summary */

This contains changes the changes for files for this cycle:

- Introduce a new reference counting mechanism for files.

  As atomic_inc_not_zero() is implemented with a try_cmpxchg() loop it
  has O(N^2) behaviour under contention with N concurrent operations and
  it is in a hot path in __fget_files_rcu().

  The rcuref infrastructures remedies this problem by using an
  unconditional increment relying on safe- and dead zones to make this
  work and requiring rcu protection for the data structure in question.
  This not just scales better it also introduces overflow protection.

  However, in contrast to generic rcuref, files require a memory barrier
  and thus cannot rely on *_relaxed() atomic operations and also require
  to be built on atomic_long_t as having massive amounts of reference
  isn't unheard of even if it is just an attack.

  This adds a file specific variant instead of making this a generic
  library.

  This has been tested by various people and it gives consistent
  improvement up to 3-5% on workloads with loads of threads.

- Add a fastpath for find_next_zero_bit(). Skip 2-levels searching via
  find_next_zero_bit() when there is a free slot in the word that contains
  the next fd. This improves pts/blogbench-1.1.0 read by 8% and write by
  4% on Intel ICX 160.

- Conditionally clear full_fds_bits since it's very likely that a bit
  in full_fds_bits has been cleared during __clear_open_fds(). This
  improves pts/blogbench-1.1.0 read up to 13%, and write up to 5% on
  Intel ICX 160.

- Get rid of all lookup_*_fdget_rcu() variants. They were used to lookup
  files without taking a reference count. That became invalid once files
  were switched to SLAB_TYPESAFE_BY_RCU and now we're always taking a
  reference count. Switch to an already existing helper and remove the
  legacy variants.

- Remove pointless includes of <linux/fdtable.h>.

- Avoid cmpxchg() in close_files() as nobody else has a reference to the
  files_struct at that point.

- Move close_range() into fs/file.c and fold __close_range() into it.

- Cleanup calling conventions of alloc_fdtable() and expand_files().

- Merge __{set,clear}_close_on_exec() into one.

- Make __set_open_fd() set cloexec as well instead of doing it
  in two separate steps.

/* Testing */

gcc version 14.2.0 (Debian 14.2.0-6)
Debian clang version 16.0.6 (27+b1)

All patches are based on v6.12-rc2 and have been sitting in linux-next.
No build failures or warnings were observed.

/* Conflicts */

Merge conflicts with mainline
=============================

No known conflicts.

Merge conflicts with other trees
================================

No known conflicts.

The following changes since commit 8cf0b93919e13d1e8d4466eb4080a4c4d9d66d7b:

  Linux 6.12-rc2 (2024-10-06 15:32:27 -0700)

are available in the Git repository at:

  git@gitolite.kernel.org:pub/scm/linux/kernel/git/vfs/vfs tags/vfs-6.13.file

for you to fetch changes up to aab154a442f9ba2a08fc130dbc8d178a33e10345:

  selftests: add file SLAB_TYPESAFE_BY_RCU recycling stressor (2024-10-30 09:58:02 +0100)

Please consider pulling these changes from the signed vfs-6.13.file tag.

Thanks!
Christian

----------------------------------------------------------------
vfs-6.13.file

----------------------------------------------------------------
Al Viro (8):
      get rid of ...lookup...fdget_rcu() family
      remove pointless includes of <linux/fdtable.h>
      close_files(): don't bother with xchg()
      move close_range(2) into fs/file.c, fold __close_range() into it
      alloc_fdtable(): change calling conventions.
      file.c: merge __{set,clear}_close_on_exec()
      make __set_open_fd() set cloexec state as well
      expand_files(): simplify calling conventions

Christian Brauner (6):
      fs: protect backing files with rcu
      fs: add file_ref
      fs: port files to file_ref
      Merge patch series "fs: introduce file_ref_t"
      Merge branch 'work.fdtable' into vfs.file
      selftests: add file SLAB_TYPESAFE_BY_RCU recycling stressor

Yu Ma (3):
      fs/file.c: remove sanity_check and add likely/unlikely in alloc_fd()
      fs/file.c: conditionally clear full_fds
      fs/file.c: add fast path in find_next_fd()

 arch/powerpc/platforms/cell/spufs/coredump.c       |   4 +-
 drivers/gpu/drm/i915/gt/shmem_utils.c              |   2 +-
 drivers/gpu/drm/vmwgfx/ttm_object.c                |   2 +-
 fs/eventpoll.c                                     |   2 +-
 fs/fcntl.c                                         |   1 -
 fs/file.c                                          | 281 +++++++++++----------
 fs/file_table.c                                    |  50 +++-
 fs/gfs2/glock.c                                    |  12 +-
 fs/notify/dnotify/dnotify.c                        |   5 +-
 fs/notify/fanotify/fanotify.c                      |   1 -
 fs/notify/fanotify/fanotify_user.c                 |   1 -
 fs/open.c                                          |  17 --
 fs/overlayfs/copy_up.c                             |   1 -
 fs/proc/base.c                                     |   1 -
 fs/proc/fd.c                                       |  12 +-
 include/linux/fdtable.h                            |   5 -
 include/linux/file.h                               |   1 +
 include/linux/file_ref.h                           | 177 +++++++++++++
 include/linux/fs.h                                 |  10 +-
 io_uring/io_uring.c                                |   1 -
 kernel/bpf/bpf_inode_storage.c                     |   1 -
 kernel/bpf/bpf_task_storage.c                      |   1 -
 kernel/bpf/task_iter.c                             |   6 +-
 kernel/bpf/token.c                                 |   1 -
 kernel/exit.c                                      |   1 -
 kernel/kcmp.c                                      |   4 +-
 kernel/module/dups.c                               |   1 -
 kernel/module/kmod.c                               |   1 -
 kernel/umh.c                                       |   1 -
 net/handshake/request.c                            |   1 -
 security/apparmor/domain.c                         |   1 -
 tools/testing/selftests/filesystems/.gitignore     |   1 +
 tools/testing/selftests/filesystems/Makefile       |   2 +-
 .../testing/selftests/filesystems/file_stressor.c  | 194 ++++++++++++++
 34 files changed, 576 insertions(+), 226 deletions(-)
 create mode 100644 include/linux/file_ref.h
 create mode 100644 tools/testing/selftests/filesystems/file_stressor.c

Re: [GIT PULL] vfs file

[pr-tracker-bot]

The pull request you sent on Fri, 15 Nov 2024 15:02:02 +0100:

> git@gitolite.kernel.org:pub/scm/linux/kernel/git/vfs/vfs tags/vfs-6.13.file

has been merged into torvalds/linux.git:
https://git.kernel.org/torvalds/c/4c797b11a88297b9b0010b2c6645b191bac2350c

Thank you!

-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/prtracker.html

[GIT PULL] vfs file

[Christian Brauner]

Hey Linus,

/* Summary */

This contains performance improvements for struct file's new refcount
mechanism and various other performance work:

- The stock kernel transitioning the file to no refs held penalizes the
  caller with an extra atomic to block any increments. For cases where
  the file is highly likely to be going away this is easily avoidable.

  Add file_ref_put_close() to better handle the common case where
  closing a file descriptor also operates on the last reference and
  build fput_close_sync() and fput_close() on top of it. This brings
  about 1% performance improvement by eliding one atomic in the common
  case.

- Predict no error in close() since the vast majority of the time system
  call returns 0.

- Reduce the work done in fdget_pos() by predicting that the file was
  found and by explicitly comparing the reference count to one and
  ignoring the dead zone.

/* Testing */

gcc version 14.2.0 (Debian 14.2.0-6)
Debian clang version 16.0.6 (27+b1)

No build failures or warnings were observed.

/* Conflicts */

Merge conflicts with mainline
=============================

No known conflicts.

Merge conflicts with other trees
================================

No known conflicts.

The following changes since commit 2014c95afecee3e76ca4a56956a936e23283f05b:

  Linux 6.14-rc1 (2025-02-02 15:39:26 -0800)

are available in the Git repository at:

  git@gitolite.kernel.org:pub/scm/linux/kernel/git/vfs/vfs tags/vfs-6.15-rc1.file

for you to fetch changes up to 5370b43e4bcf60049bfd44db83ba8d2ec43d0152:

  fs: reduce work in fdget_pos() (2025-03-20 09:45:39 +0100)

Please consider pulling these changes from the signed vfs-6.15-rc1.file tag.

Thanks!
Christian

----------------------------------------------------------------
vfs-6.15-rc1.file

----------------------------------------------------------------
Christian Brauner (1):
      Merge patch series "avoid the extra atomic on a ref when closing a fd"

Mateusz Guzik (6):
      fs: predict no error in close()
      file: add fput and file_ref_put routines optimized for use when closing a fd
      fs: use fput_close_sync() in close()
      fs: use fput_close() in filp_close()
      fs: use fput_close() in path_openat()
      fs: reduce work in fdget_pos()

 fs/file.c                | 52 ++++++++++++++++++++---------------
 fs/file_table.c          | 70 +++++++++++++++++++++++++++++++++---------------
 fs/internal.h            |  3 +++
 fs/namei.c               |  2 +-
 fs/open.c                | 15 ++++++-----
 include/linux/file_ref.h | 48 +++++++++++++++++++++++++++++++++
 6 files changed, 141 insertions(+), 49 deletions(-)

Re: [GIT PULL] vfs file

[pr-tracker-bot]

The pull request you sent on Sat, 22 Mar 2025 11:17:12 +0100:

> git@gitolite.kernel.org:pub/scm/linux/kernel/git/vfs/vfs tags/vfs-6.15-rc1.file

has been merged into torvalds/linux.git:
https://git.kernel.org/torvalds/c/912b82dc0b27abc407c831e74fbcbdebfe19997b

Thank you!

-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/prtracker.html